white-box testing techniques iiwhite-box testing topics •logic coverage (lecture i) •dataflow...

130
White-Box Testing Techniques II Prepared by Stephen M. Thebaut, Ph.D. University of Florida Software Testing and Verification Lecture 8

Upload: others

Post on 07-Mar-2021

6 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

White-Box Testing Techniques II

Prepared by

Stephen M. Thebaut, Ph.D.

University of Florida

Software Testing and Verification

Lecture 8

Page 2: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

White-Box Testing Topics

• Logic coverage (lecture I)

• Dataflow coverage (lecture II)

• Path conditions and symbolic execution (lecture III)

• Other white-box testing strategies (e.g., “fault-based testing”) (lecture IV)

Page 3: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Dataflow Coverage

• Based on the idea that program paths along which variables are defined and then used should be covered.

• Families of path selection criteria have been defined based on somewhat different models/definitions. The different criteria reflect different degrees of coverage.

• The model/definitions we consider are representative.

• CASE tool support is very desirable.

Page 4: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Dataflow Coverage

• Based on the idea that program paths along which variables are defined and then used should be covered.

• Families of path selection criteria have been defined based on somewhat different models/definitions. The different criteria reflect different degrees of coverage.

• The model/definitions we consider are representative.

• CASE tool support is very desirable.

Page 5: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Dataflow Coverage

• Based on the idea that program paths along which variables are defined and then used should be covered.

• Families of path selection criteria have been defined based on somewhat different models/definitions. The different criteria reflect different degrees of coverage.

• The model/definitions we consider are representative.

• CASE tool support is very desirable.

Page 6: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Dataflow Coverage

• Based on the idea that program paths along which variables are defined and then used should be covered.

• Families of path selection criteria have been defined based on somewhat different models/definitions. The different criteria reflect different degrees of coverage.

• The model/definitions we consider are representative.

• CASE tool support is very desirable.

Page 7: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Variable Definitions and Uses

• A program variable is DEFINED when it appears:

– on the left hand side of an assignment statement (e.g., Y := 17)

– in an input statement (e.g., input(Y))

– as an OUT parameter in a subroutine call (e.g., DOIT(X:IN,Y:OUT))

Page 8: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Variable Definitions and Uses

• A program variable is DEFINED when it appears:

– on the left hand side of an assignment statement (e.g., Y := 17)

– in an input statement (e.g., input(Y))

– as an OUT parameter in a subroutine call (e.g., DOIT(X:IN,Y:OUT))

Page 9: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Variable Definitions and Uses

• A program variable is DEFINED when it appears:

– on the left hand side of an assignment statement (e.g., Y := 17)

– in an input statement (e.g., input(Y))

– as an OUT parameter in a subroutine call (e.g., DOIT(X:IN,Y:OUT))

Page 10: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Variable Definitions and Uses

• A program variable is DEFINED when it appears:

– on the left hand side of an assignment statement (e.g., Y := 17)

– in an input statement (e.g., input(Y))

– as an OUT parameter in a subroutine call (e.g., DOIT(X:IN,Y:OUT))

(cont’d)

Page 11: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Variable Definitions and Uses

(cont’d)

• A program variable is USED when it appears:

– on the right hand side of an assignment statement (e.g., Y := X+17)

– as an IN parameter in a subroutine or function call (e.g., Y := SQRT(X))

– in the predicate of a branch statement (e.g., if X>0 then...)

Page 12: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Variable Definitions and Uses

(cont’d)

• A program variable is USED when it appears:

– on the right hand side of an assignment statement (e.g., Y := X+17)

– as an IN parameter in a subroutine or function call (e.g., Y := SQRT(X))

– in the predicate of a branch statement (e.g., if X>0 then...)

Page 13: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Variable Definitions and Uses

(cont’d)

• A program variable is USED when it appears:

– on the right hand side of an assignment statement (e.g., Y := X+17)

– as an IN parameter in a subroutine or function call (e.g., Y := SQRT(X))

– in the predicate of a branch statement (e.g., if X>0 then...)

Page 14: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Variable Definitions and Uses

(cont’d)

• A program variable is USED when it appears:

– on the right hand side of an assignment statement (e.g., Y := X+17)

– as an IN parameter in a subroutine or function call (e.g., Y := SQRT(X))

– in the predicate of a branch statement (e.g., if X>0 then...)

(cont’d)

Page 15: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Variable Definitions and Uses

(cont’d)

• Use of a variable in the predicate of a branch statement is called a predicate-use (“p-use”). Any other use is called a computation-use (“c-use”).

• For example, in the program statement:

If (X>0) then

print(Y)

end_if_then

there is a p-use of X and a c-use of Y.

Page 16: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Variable Definitions and Uses

(cont’d)

• Use of a variable in the predicate of a branch statement is called a predicate-use (“p-use”). Any other use is called a computation-use (“c-use”).

• For example, in the program statement:

If (X>0) then

print(Y)

end_if_then

there is a p-use of X and a c-use of Y.

(cont’d)

Page 17: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Variable Definitions and Uses

(cont’d)

• A variable can also be used and then re-defined in a single statement when it appears:

– on both sides of an assignment statement (e.g., Y := Y+X)

– as an IN/OUT parameter in a subroutine call (e.g., INCREMENT(Y:IN/OUT))

Page 18: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Variable Definitions and Uses

(cont’d)

• A variable can also be used and then re-defined in a single statement when it appears:

– on both sides of an assignment statement (e.g., Y := Y+X)

– as an IN/OUT parameter in a subroutine call (e.g., INCREMENT(Y:IN/OUT))

Page 19: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Variable Definitions and Uses

(cont’d)

• A variable can also be used and then re-defined in a single statement when it appears:

– on both sides of an assignment statement (e.g., Y := Y+X)

– as an IN/OUT parameter in a subroutine call (e.g., INCREMENT(Y:IN/OUT))

Page 20: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Other Dataflow Terms and (Informal)

Definitions

• A path is definition clear (“def-clear”)with respect to a variable v if there is no re-definition of v along the path.

• A complete path is a path whose initial node is a/the start node and whose final node is a/the exit node.

Page 21: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Other Dataflow Terms and (Informal)

Definitions

• A path is definition clear (“def-clear”)with respect to a variable v if there is no re-definition of v along the path.

• A complete path is a path whose initial node is a/the start node and whose final node is a/the exit node.

(cont’d)

Page 22: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Other Dataflow Terms and (Informal)

Definitions (cont’d)

• A definition-use pair (“du-pair”) with respect to a variable v is a double (d,u) such that d is a node in the program’s flow graph at which v is defined, u is a node or edge at which v is used, and there is a def-clear path with respect to v from d to u.

• (Note that the definition of a du-pair does not require the existence of a feasible def-clear path from d to u.)

Page 23: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Example 1

1. input(A,B)

if (B>1) then

2. A := A+7

end_if

3. if (A>10) then

4. B := A+B

end_if

5. output(A,B)

1

2

3

4

5

input(A,B)

A := A+7

B := A+B

B>1

B1

A>10

A10

output(A,B)

Page 24: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable A

du-pair path(s)

(1,2) <1,2>

(1,4) <1,3,4>

(1,5) <1,3,4,5>

<1,3,5>

(1,<3,4>) <1,3,4>

(1,<3,5>) <1,3,5>

(2,4) <2,3,4>

(2,5) <2,3,4,5>

<2,3,5>

(2,<3,4>) <2,3,4>

(2,<3,5>) <2,3,5>

1

2

3

4

5

input(A,B)

A := A+7

B := A+B

B>1

B1

A>10

A10

output(A,B)

Page 25: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable A

du-pair path(s)

(1,2) <1,2>

(1,4) <1,3,4>

(1,5) <1,3,4,5>

<1,3,5>

(1,<3,4>) <1,3,4>

(1,<3,5>) <1,3,5>

(2,4) <2,3,4>

(2,5) <2,3,4,5>

<2,3,5>

(2,<3,4>) <2,3,4>

(2,<3,5>) <2,3,5>

1

2

3

4

5

input(A,B)

A := A+7

B := A+B

B>1

B1

A>10

A10

output(A,B)

Page 26: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable A

du-pair path(s)

(1,2) <1,2>

(1,4) <1,3,4>

(1,5) <1,3,4,5>

<1,3,5>

(1,<3,4>) <1,3,4>

(1,<3,5>) <1,3,5>

(2,4) <2,3,4>

(2,5) <2,3,4,5>

<2,3,5>

(2,<3,4>) <2,3,4>

(2,<3,5>) <2,3,5>

1

2

3

4

5

input(A,B)

A := A+7

B := A+B

B>1

B1

A>10

A10

output(A,B)

Page 27: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable A

du-pair path(s)

(1,2) <1,2>

(1,4) <1,3,4>

(1,5) <1,3,4,5>

<1,3,5>

(1,<3,4>) <1,3,4>

(1,<3,5>) <1,3,5>

(2,4) <2,3,4>

(2,5) <2,3,4,5>

<2,3,5>

(2,<3,4>) <2,3,4>

(2,<3,5>) <2,3,5>

1

2

3

4

5

input(A,B)

A := A+7

B := A+B

B>1

B1

A>10

A10

output(A,B)

Page 28: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable A

du-pair path(s)

(1,2) <1,2>

(1,4) <1,3,4>

(1,5) <1,3,4,5>

<1,3,5>

(1,<3,4>) <1,3,4>

(1,<3,5>) <1,3,5>

(2,4) <2,3,4>

(2,5) <2,3,4,5>

<2,3,5>

(2,<3,4>) <2,3,4>

(2,<3,5>) <2,3,5>

1

2

3

4

5

input(A,B)

A := A+7

B := A+B

B>1

B1

A>10

A10

output(A,B)

Page 29: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable A

du-pair path(s)

(1,2) <1,2>

(1,4) <1,3,4>

(1,5) <1,3,4,5>

<1,3,5>

(1,<3,4>) <1,3,4>

(1,<3,5>) <1,3,5>

(2,4) <2,3,4>

(2,5) <2,3,4,5>

<2,3,5>

(2,<3,4>) <2,3,4>

(2,<3,5>) <2,3,5>

1

2

3

4

5

input(A,B)

A := A+7

B := A+B

B>1

B1

A>10

A10

output(A,B)

Page 30: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable A

du-pair path(s)

(1,2) <1,2>

(1,4) <1,3,4>

(1,5) <1,3,4,5>

<1,3,5>

(1,<3,4>) <1,3,4>

(1,<3,5>) <1,3,5>

(2,4) <2,3,4>

(2,5) <2,3,4,5>

<2,3,5>

(2,<3,4>) <2,3,4>

(2,<3,5>) <2,3,5>

1

2

3

4

5

input(A,B)

A := A+7

B := A+B

B>1

B1

A>10

A10

output(A,B)

Page 31: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable A

du-pair path(s)

(1,2) <1,2>

(1,4) <1,3,4>

(1,5) <1,3,4,5>

<1,3,5>

(1,<3,4>) <1,3,4>

(1,<3,5>) <1,3,5>

(2,4) <2,3,4>

(2,5) <2,3,4,5>

<2,3,5>

(2,<3,4>) <2,3,4>

(2,<3,5>) <2,3,5>

1

2

3

4

5

input(A,B)

A := A+7

B := A+B

B>1

B1

A>10

A10

output(A,B)

Page 32: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable A

du-pair path(s)

(1,2) <1,2>

(1,4) <1,3,4>

(1,5) <1,3,4,5>

<1,3,5>

(1,<3,4>) <1,3,4>

(1,<3,5>) <1,3,5>

(2,4) <2,3,4>

(2,5) <2,3,4,5>

<2,3,5>

(2,<3,4>) <2,3,4>

(2,<3,5>) <2,3,5>

1

2

3

4

5

input(A,B)

A := A+7

B := A+B

B>1

B1

A>10

A10

output(A,B)

Page 33: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable A

du-pair path(s)

(1,2) <1,2>

(1,4) <1,3,4>

(1,5) <1,3,4,5>

<1,3,5>

(1,<3,4>) <1,3,4>

(1,<3,5>) <1,3,5>

(2,4) <2,3,4>

(2,5) <2,3,4,5>

<2,3,5>

(2,<3,4>) <2,3,4>

(2,<3,5>) <2,3,5>

1

2

3

4

5

input(A,B)

A := A+7

B := A+B

B>1

B1

A>10

A10

output(A,B)

Page 34: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable A

du-pair path(s)

(1,2) <1,2>

(1,4) <1,3,4>

(1,5) <1,3,4,5>

<1,3,5>

(1,<3,4>) <1,3,4>

(1,<3,5>) <1,3,5>

(2,4) <2,3,4>

(2,5) <2,3,4,5>

<2,3,5>

(2,<3,4>) <2,3,4>

(2,<3,5>) <2,3,5>

1

2

3

4

5

input(A,B)

A := A+7

B := A+B

B>1

B1

A>10

A10

output(A,B)

Page 35: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable A

du-pair path(s)

(1,2) <1,2>

(1,4) <1,3,4>

(1,5) <1,3,4,5>

<1,3,5>

(1,<3,4>) <1,3,4>

(1,<3,5>) <1,3,5>

(2,4) <2,3,4>

(2,5) <2,3,4,5>

<2,3,5>

(2,<3,4>) <2,3,4>

(2,<3,5>) <2,3,5>

1

2

3

4

5

input(A,B)

A := A+7

B := A+B

B>1

B1

A>10

A10

output(A,B)

Page 36: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable B

du-pair path(s)

(1,4) <1,2,3,4>

<1,3,4>

(1,5) <1,2,3,5>

<1,3,5>

(1,<1,2>) <1,2>

(1,<1,3>) <1,3>

(4,5) <4,5>

1

2

3

4

5

input(A,B)

A := A+7

B := A+B

B>1

B1

A>10

A10

output(A,B)

(Verification of du-pairs/paths(s) left as an exercise...)

Page 37: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Dataflow Test Coverage Criteria

• All-Defs: for every program variable v, at least one def-clear path from every definition of v to at least one c-use or one p-use of v must be covered.

Page 38: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Dataflow Test Coverage Criteria

(cont’d)

• Consider a test case executing path:

1. <1,2,3,4,5>

• Identify all def-clear paths (associated with du-pairs) covered (i.e., subsumed) by this test case for each variable.

• Are all definitions for each variable associated with at least one of the subsumed def-clear paths?

Page 39: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Dataflow Test Coverage Criteria

(cont’d)

• Consider a test case executing path:

1. <1,2,3,4,5>

• Identify all def-clear paths (associated with du-pairs) covered (i.e., subsumed)by this test case for each variable.

• Are all definitions for each variable associated with at least one of the subsumed def-clear paths?

Page 40: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Dataflow Test Coverage Criteria

(cont’d)

• Consider a test case executing path:

1. <1,2,3,4,5>

• Identify all def-clear paths (associated with du-pairs) covered (i.e., subsumed)by this test case for each variable.

• Are all definitions for each variableassociated with at least one of the subsumed def-clear paths?

Page 41: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Def-Clear Paths Subsumed by <1,2,3,4,5>

for Variable A

du-pair path(s)

(1,2) <1,2>

(1,4) <1,3,4>

(1,5) <1,3,4,5>

<1,3,5>

(1,<3,4>) <1,3,4>

(1,<3,5>) <1,3,5>

(2,4) <2,3,4>

(2,5) <2,3,4,5>

<2,3,5>

(2,<3,4>) <2,3,4>

(2,<3,5>) <2,3,5>

1

2

3

4

5

input(A,B)

A := A+7

B := A+B

B>1

B1

A>10

A10

output(A,B)

Page 42: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Def-Clear Paths Subsumed by <1,2,3,4,5>

for Variable B

du-pair path(s)

(1,4) <1,2,3,4>

<1,3,4>

(1,5) <1,2,3,5>

<1,3,5>

(1,<1,2>) <1,2>

(1,<1,3>) <1,3>

(4,5) <4,5>

1

2

3

4

5

input(A,B)

A := A+7

B := A+B

B>1

B1

A>10

A10

output(A,B)

Page 43: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Dataflow Test Coverage Criteria

(cont’d)

• Since <1,2,3,4,5> covers at least one def-

clear path from each of the two definitions of A/B to at least one c-use or p-use of A/B, All-Defs coverage is achieved.

(cont’d)

Page 44: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Dataflow Test Coverage Criteria

(cont’d)

• All-Uses: for every program variable v, at least one def-clear path from every definition of v to every c-useand every p-use of v must be covered.

• Consider additional test cases executing paths:

2. <1,3,4,5>

3. <1,2,3,5>

• Do all three test cases provide All-Uses coverage?

Page 45: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Dataflow Test Coverage Criteria

(cont’d)

• All-Uses: for every program variable v, at least one def-clear path from every definition of v to every c-useand every p-use of v must be covered.

• Consider additional test cases executing paths:

2. <1,3,4,5>

3. <1,2,3,5>

• Do all three test cases provide All-Uses coverage?

Page 46: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Dataflow Test Coverage Criteria

(cont’d)

• All-Uses: for every program variable v, at least one def-clear path from every definition of v to every c-useand every p-use of v must be covered.

• Consider additional test cases executing paths:

2. <1,3,4,5>

3. <1,2,3,5>

• Do all three test cases provide All-Uses coverage?

Page 47: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Def-Clear Paths Subsumed by <1,3,4,5>

for Variable A

du-pair path(s)

(1,2) <1,2>

(1,4) <1,3,4>

(1,5) <1,3,4,5>

<1,3,5>

(1,<3,4>) <1,3,4>

(1,<3,5>) <1,3,5>

(2,4) <2,3,4>

(2,5) <2,3,4,5>

<2,3,5>

(2,<3,4>) <2,3,4>

(2,<3,5>) <2,3,5>

1

2

3

4

5

input(A,B)

A := A+7

B := A+B

B>1

B1

A>10

A10

output(A,B)

Page 48: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Def-Clear Paths Subsumed by <1,3,4,5>

for Variable B

du-pair path(s)

(1,4) <1,2,3,4>

<1,3,4>

(1,5) <1,2,3,5>

<1,3,5>

(1,<1,2>) <1,2>

(1,<1,3>) <1,3>

(4,5) <4,5>

1

2

3

4

5

input(A,B)

A := A+7

B := A+B

B>1

B1

A>10

A10

output(A,B)

Page 49: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Def-Clear Paths Subsumed by <1,2,3,5>

for Variable A

du-pair path(s)

(1,2) <1,2>

(1,4) <1,3,4>

(1,5) <1,3,4,5>

<1,3,5>

(1,<3,4>) <1,3,4>

(1,<3,5>) <1,3,5>

(2,4) <2,3,4>

(2,5) <2,3,4,5>

<2,3,5>

(2,<3,4>) <2,3,4>

(2,<3,5>) <2,3,5>

1

2

3

4

5

input(A,B)

A := A+7

B := A+B

B>1

B1

A>10

A10

output(A,B)

Page 50: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Def-Clear Paths Subsumed by <1,2,3,5>

for Variable B

1

2

3

4

5

input(A,B)

A := A+7

B := A+B

B>1

B1

A>10

A10

output(A,B)

du-pair path(s)

(1,4) <1,2,3,4>

<1,3,4>

(1,5) <1,2,3,5>

<1,3,5>

(1,<1,2>) <1,2>

(1,<1,3>) <1,3>

(4,5) <4,5>

Page 51: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Dataflow Test Coverage Criteria

(cont’d)

• Since none of the three test cases covers the du-pair (1,<3,5>) for variable A, All-Uses Coverage is not achieved.

• Exercise: Did the three test cases considered provide Branch coverage? Basis Path coverage? Path coverage?

Page 52: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Dataflow Test Coverage Criteria

(cont’d)

• Since none of the three test cases covers the du-pair (1,<3,5>) for variable A, All-Uses Coverage is not achieved.

• Exercise: Did the three test cases considered provide Branch coverage? Basis Paths coverage? Path coverage?

Page 53: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

What would be even stronger than All-Uses?

• We have considered the All-Defs and the All-Uses criteria so far. How could the definition of All-Uses be modified to make it even stronger? Recall:

All-Uses: for every program variable v, at least one def-clear path from every definition of v to every c-use and every p-use of v must be covered.

Page 54: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

What would be even stronger than All-Uses?

• We have considered the All-Defs and the All-Uses criteria so far. How could the definition of All-Uses be modified to make it even stronger? Recall:

All-Uses: for every program variable v, at least one def-clear path from every definition of v to every c-use and every p-use of v must be covered.

Page 55: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Example 2

1. input(X,Y)

2. while (Y>0) do

3. if (X>0) then

4. Y := Y-X

else

5. input(X)

end_if_then_else

6. end_while

7. output(X,Y)

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

Page 56: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Example 2

1. input(X,Y)

2. while (Y>0) do

3. if (X>0) then

4. Y := Y-X

else

5. input(X)

end_if_then_else

6. end_while

7. output(X,Y)

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

Note edges <6,7> and <6,3>.

Page 57: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Logic Coverage Control Flow Graph

input(a)

while a do

if b then s1

else s2

end_if_then_else

end_while

output(a)

Page 58: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Dataflow Coverage Control Flow Graph

input(a)

while a do

if b then s1

else s2

end_if_then_else

end_while

output(a)

Page 59: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(1,4) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,7) <1,2,7>

<1,2,3,4,6,7>

<1,2,3,4,6,(3,4,6)*,7>

(1,<3,4>) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,<3,5>) <1,2,3,5>

(5,4) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

(cont’d)

Page 60: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(1,4) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,7) <1,2,7>

<1,2,3,4,6,7>

<1,2,3,4,6,(3,4,6)*,7>

(1,<3,4>) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,<3,5>) <1,2,3,5>

(5,4) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

(cont’d)

Page 61: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(1,4) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,7) <1,2,7>

<1,2,3,4,6,7>

<1,2,3,4,6,(3,4,6)*,7>

(1,<3,4>) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,<3,5>) <1,2,3,5>

(5,4) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

(cont’d)

Page 62: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(1,4) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,7) <1,2,7>

<1,2,3,4,6,7>

<1,2,3,4,6,(3,4,6)*,7>

(1,<3,4>) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,<3,5>) <1,2,3,5>

(5,4) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

(cont’d)

Page 63: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(1,4) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,7) <1,2,7>

<1,2,3,4,6,7>

<1,2,3,4,6,(3,4,6)*,7>

(1,<3,4>) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,<3,5>) <1,2,3,5>

(5,4) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

(cont’d)

Page 64: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(1,4) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,7) <1,2,7>

<1,2,3,4,6,7>

<1,2,3,4,6,(3,4,6)*,7>

(1,<3,4>) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,<3,5>) <1,2,3,5>

(5,4) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

(cont’d)

Page 65: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(1,4) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,7) <1,2,7>

<1,2,3,4,6,7>

<1,2,3,4,6,(3,4,6)*,7>

(1,<3,4>) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,<3,5>) <1,2,3,5>

(5,4) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

(cont’d)

Page 66: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(1,4) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,7) <1,2,7>

<1,2,3,4,6,7>

<1,2,3,4,6,(3,4,6)*,7>

(1,<3,4>) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,<3,5>) <1,2,3,5>

(5,4) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

(cont’d)

Page 67: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(1,4) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,7) <1,2,7>

<1,2,3,4,6,7>

<1,2,3,4,6,(3,4,6)*,7>

(1,<3,4>) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,<3,5>) <1,2,3,5>

(5,4) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

(cont’d)

Page 68: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(1,4) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,7) <1,2,7>

<1,2,3,4,6,7>

<1,2,3,4,6,(3,4,6)*,7>

(1,<3,4>) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,<3,5>) <1,2,3,5>

(5,4) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

(cont’d)

Page 69: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(1,4) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,7) <1,2,7>

<1,2,3,4,6,7>

<1,2,3,4,6,(3,4,6)*,7>

(1,<3,4>) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,<3,5>) <1,2,3,5>

(5,4) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

(cont’d)

Page 70: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(1,4) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,7) <1,2,7>

<1,2,3,4,6,7>

<1,2,3,4,6,(3,4,6)*,7>

(1,<3,4>) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,<3,5>) <1,2,3,5>

(5,4) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

(cont’d)

Page 71: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(1,4) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,7) <1,2,7>

<1,2,3,4,6,7>

<1,2,3,4,6,(3,4,6)*,7>

(1,<3,4>) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,<3,5>) <1,2,3,5>

(5,4) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

(cont’d)

Page 72: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(1,4) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,7) <1,2,7>

<1,2,3,4,6,7>

<1,2,3,4,6,(3,4,6)*,7>

(1,<3,4>) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,<3,5>) <1,2,3,5>

(5,4) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

(cont’d)

Page 73: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(1,4) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,7) <1,2,7>

<1,2,3,4,6,7>

<1,2,3,4,6,(3,4,6)*,7>

(1,<3,4>) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,<3,5>) <1,2,3,5>

(5,4) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

(cont’d)

Page 74: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(1,4) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,7) <1,2,7>

<1,2,3,4,6,7>

<1,2,3,4,6,(3,4,6)*,7>

(1,<3,4>) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,<3,5>) <1,2,3,5>

(5,4) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

(cont’d)

Page 75: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(1,4) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,7) <1,2,7>

<1,2,3,4,6,7>

<1,2,3,4,6,(3,4,6)*,7>

(1,<3,4>) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,<3,5>) <1,2,3,5>

(5,4) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

(cont’d)

Page 76: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(1,4) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,7) <1,2,7>

<1,2,3,4,6,7>

<1,2,3,4,6,(3,4,6)*,7>

(1,<3,4>) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,<3,5>) <1,2,3,5>

(5,4) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

(cont’d)

Page 77: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(1,4) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,7) <1,2,7>

<1,2,3,4,6,7>

<1,2,3,4,6,(3,4,6)*,7>

(1,<3,4>) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,<3,5>) <1,2,3,5>

(5,4) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

(cont’d)

Page 78: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(1,4) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,7) <1,2,7>

<1,2,3,4,6,7>

<1,2,3,4,6,(3,4,6)*,7>

(1,<3,4>) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,<3,5>) <1,2,3,5>

(5,4) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

(cont’d)

Page 79: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(1,4) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,7) <1,2,7>

<1,2,3,4,6,7>

<1,2,3,4,6,(3,4,6)*,7>

(1,<3,4>) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,<3,5>) <1,2,3,5>

(5,4) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

(cont’d)

Page 80: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(1,4) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,7) <1,2,7>

<1,2,3,4,6,7>

<1,2,3,4,6,(3,4,6)*,7>

(1,<3,4>) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,<3,5>) <1,2,3,5>

(5,4) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

(cont’d)

Page 81: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(1,4) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,7) <1,2,7>

<1,2,3,4,6,7>

<1,2,3,4,6,(3,4,6)*,7>

(1,<3,4>) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,<3,5>) <1,2,3,5>

(5,4) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

(cont’d)

Page 82: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(1,4) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,7) <1,2,7>

<1,2,3,4,6,7>

<1,2,3,4,6,(3,4,6)*,7>

(1,<3,4>) <1,2,3,4>

<1,2,3,4,(6,3,4)*>

(1,<3,5>) <1,2,3,5>

(5,4) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

(cont’d)

Page 83: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(5,7) <5,6,7>

<5,6,3,4,6,7>

<5,6,3,4,6,(3,4,6)*,7>

(5,<3,4>) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

(5,<3,5>) <5,6,3,5>

<5,6,3,4,6,3,5>

<5,6,3,4,6,(3,4,6)*,3,5>

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

Page 84: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(5,7) <5,6,7> †

<5,6,3,4,6,7>

<5,6,3,4,6,(3,4,6)*,7>

(5,<3,4>) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

(5,<3,5>) <5,6,3,5>

<5,6,3,4,6,3,5>

<5,6,3,4,6,(3,4,6)*,3,5>

† infeasible

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

Page 85: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(5,7) <5,6,7> †

<5,6,3,4,6,7>

<5,6,3,4,6,(3,4,6)*,7>

(5,<3,4>) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

(5,<3,5>) <5,6,3,5>

<5,6,3,4,6,3,5>

<5,6,3,4,6,(3,4,6)*,3,5>

† infeasible

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

Page 86: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(5,7) <5,6,7> †

<5,6,3,4,6,7>

<5,6,3,4,6,(3,4,6)*,7>

(5,<3,4>) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

(5,<3,5>) <5,6,3,5>

<5,6,3,4,6,3,5>

<5,6,3,4,6,(3,4,6)*,3,5>

† infeasible

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

Page 87: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(5,7) <5,6,7> †

<5,6,3,4,6,7>

<5,6,3,4,6,(3,4,6)*,7>

(5,<3,4>) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

(5,<3,5>) <5,6,3,5>

<5,6,3,4,6,3,5>

<5,6,3,4,6,(3,4,6)*,3,5>

† infeasible

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

Page 88: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(5,7) <5,6,7> †

<5,6,3,4,6,7>

<5,6,3,4,6,(3,4,6)*,7>

(5,<3,4>) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

(5,<3,5>) <5,6,3,5>

<5,6,3,4,6,3,5>

<5,6,3,4,6,(3,4,6)*,3,5>

† infeasible

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

Page 89: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(5,7) <5,6,7> †

<5,6,3,4,6,7>

<5,6,3,4,6,(3,4,6)*,7>

(5,<3,4>) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

(5,<3,5>) <5,6,3,5>

<5,6,3,4,6,3,5>

<5,6,3,4,6,(3,4,6)*,3,5>

† infeasible

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

Page 90: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(5,7) <5,6,7> †

<5,6,3,4,6,7>

<5,6,3,4,6,(3,4,6)*,7>

(5,<3,4>) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

(5,<3,5>) <5,6,3,5>

<5,6,3,4,6,3,5>

<5,6,3,4,6,(3,4,6)*,3,5>

† infeasible

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

Page 91: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(5,7) <5,6,7> †

<5,6,3,4,6,7>

<5,6,3,4,6,(3,4,6)*,7>

(5,<3,4>) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

(5,<3,5>) <5,6,3,5>

<5,6,3,4,6,3,5>

<5,6,3,4,6,(3,4,6)*,3,5>

† infeasible

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

Page 92: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(5,7) <5,6,7> †

<5,6,3,4,6,7>

<5,6,3,4,6,(3,4,6)*7>

(5,<3,4>) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

(5,<3,5>) <5,6,3,5>

<5,6,3,4,6,3,5>

<5,6,3,4,6,(3,4,6)*,3,5>

† infeasible

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

Page 93: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(5,7) <5,6,7> †

<5,6,3,4,6,7>

<5,6,3,4,6,(3,4,6)*7>

(5,<3,4>) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

(5,<3,5>) <5,6,3,5>

<5,6,3,4,6,3,5>

<5,6,3,4,6,(3,4,6)*,3,5>

† infeasible

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

Page 94: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(5,7) <5,6,7> †

<5,6,3,4,6,7>

<5,6,3,4,6,(3,4,6)*7>

(5,<3,4>) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

(5,<3,5>) <5,6,3,5>

<5,6,3,4,6,3,5> †

<5,6,3,4,6,(3,4,6)*,3,5>

† infeasible

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

Page 95: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying DU-Pairs – Variable X

du-pair path(s)

(5,7) <5,6,7> †

<5,6,3,4,6,7>

<5,6,3,4,6,(3,4,6)*7>

(5,<3,4>) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

(5,<3,5>) <5,6,3,5>

<5,6,3,4,6,3,5> †

<5,6,3,4,6,(3,4,6)*,3,5> †

† infeasible

1

3

input(X,Y))

Y := Y-Xinput(X)

Y>0

Y0

X>0

output(X,Y)

X0

2

45

6

7Y>0

Y0

Page 96: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

More Dataflow Terms and Definitions

• A path (either partial or complete) is simple if all edges within the path are distinct (i.e., different).

• A path is loop-free if all nodes within the path are distinct (i.e., different).

Page 97: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

More Dataflow Terms and Definitions

• A path (either partial or complete) is simple if all edges within the path are distinct (i.e., different).

• A path is loop-free if all nodes within the path are distinct (i.e., different).

Page 98: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Simple and Loop-Free Paths

path Simple? Loop-free?

<1,3,4,2> ? ?

<1,2,3,2>

<1,2,3,1,2>

<1,2,3,2,4>

Page 99: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Simple and Loop-Free Paths

path Simple? Loop-free?

<1,3,4,2> yes yes

<1,2,3,2>

<1,2,3,1,2>

<1,2,3,2,4>

Page 100: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Simple and Loop-Free Paths

path Simple? Loop-free?

<1,3,4,2> yes yes

<1,2,3,2> ? ?

<1,2,3,1,2>

<1,2,3,2,4>

Page 101: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Simple and Loop-Free Paths

path Simple? Loop-free?

<1,3,4,2> yes yes

<1,2,3,2> yes no

<1,2,3,1,2>

<1,2,3,2,4>

Page 102: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Simple and Loop-Free Paths

path Simple? Loop-free?

<1,3,4,2> yes yes

<1,2,3,2> yes no

<1,2,3,1,2> ? ?

<1,2,3,2,4>

Page 103: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Simple and Loop-Free Paths

path Simple? Loop-free?

<1,3,4,2> yes yes

<1,2,3,2> yes no

<1,2,3,1,2> no no

<1,2,3,2,4>

Page 104: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Simple and Loop-Free Paths

path Simple? Loop-free?

<1,3,4,2> yes yes

<1,2,3,2> yes no

<1,2,3,1,2> no no

<1,2,3,2,4> ? ?

Page 105: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Simple and Loop-Free Paths

path Simple? Loop-free?

<1,3,4,2> yes yes

<1,2,3,2> yes no

<1,2,3,1,2> no no

<1,2,3,2,4> yes no

Page 106: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Simple and Loop-Free Paths (cont’d)

Which is stronger, simple or loop-free?

Loop-free => Simple

Simple => Loop-free

Page 107: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

More Dataflow Terms and Definitions

A path <n1,n2,...,nj,nk> is a du-path

with respect to a variable v if v is defined at node n1 and either:

1. there is a c-use of v at node nk and<n1,n2,...,nj,nk> is a def-clear simple path, or

2. there is a p-use of v at edge <nj,nk> and <n1,n2,...nj> is a def-clear loop-

free path.

Page 108: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

More Dataflow Terms and Definitions

A path <n1,n2,...,nj,nk> is a du-path

with respect to a variable v if v is defined at node n1 and either:

1. there is a c-use of v at node nk and<n1,n2,...,nj,nk> is a def-clear simple path, or

2. there is a p-use of v at edge <nj,nk> and <n1,n2,...nj> is a def-clear loop-

free path.

NOTE!

Page 109: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying du-paths

du-pair path(s) du-path?

X: (5,7) <5,6,7> † ?

<5,6,3,4,6,7>

<5,6,3,4,6,(3,4,6)*,7>

X: (5,<3,4>) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

X: (5,<3,5>) <5,6,3,5>

<5,6,3,4,6,3,5> †

<5,6,3,4,6,(3,4,6)*,3,5> †

† infeasible

Page 110: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying du-paths

du-pair path(s) du-path?

X: (5,7) <5,6,7> † yes

<5,6,3,4,6,7>

<5,6,3,4,6,(3,4,6)*,7>

X: (5,<3,4>) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

X: (5,<3,5>) <5,6,3,5>

<5,6,3,4,6,3,5> †

<5,6,3,4,6,(3,4,6)*,3,5> †

† infeasible

Page 111: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying du-paths

du-pair path(s) du-path?

X: (5,7) <5,6,7> † yes

<5,6,3,4,6,7> ?

<5,6,3,4,6,(3,4,6)*,7>

X: (5,<3,4>) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

X: (5,<3,5>) <5,6,3,5>

<5,6,3,4,6,3,5> †

<5,6,3,4,6,(3,4,6)*,3,5> †

† infeasible

Page 112: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying du-paths

du-pair path(s) du-path?

X: (5,7) <5,6,7> † yes

<5,6,3,4,6,7> yes

<5,6,3,4,6,(3,4,6)*,7>

X: (5,<3,4>) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

X: (5,<3,5>) <5,6,3,5>

<5,6,3,4,6,3,5> †

<5,6,3,4,6,(3,4,6)*,3,5> †

† infeasible

Page 113: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying du-paths

du-pair path(s) du-path?

X: (5,7) <5,6,7> † yes

<5,6,3,4,6,7> yes

<5,6,3,4,6,(3,4,6)*,7> ?

X: (5,<3,4>) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

X: (5,<3,5>) <5,6,3,5>

<5,6,3,4,6,3,5> †

<5,6,3,4,6,(3,4,6)*,3,5> †

† infeasible

Page 114: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying du-paths

du-pair path(s) du-path?

X: (5,7) <5,6,7> † yes

<5,6,3,4,6,7> yes

<5,6,3,4,6,(3,4,6)*,7> no

X: (5,<3,4>) <5,6,3,4>

<5,6,3,4,(6,3,4)*>

X: (5,<3,5>) <5,6,3,5>

<5,6,3,4,6,3,5> †

<5,6,3,4,6,(3,4,6)*,3,5> †

† infeasible

Page 115: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying du-paths

du-pair path(s) du-path?

X: (5,7) <5,6,7> † yes

<5,6,3,4,6,7> yes

<5,6,3,4,6,(3,4,6)*,7> no

X: (5,<3,4>) <5,6,3,4> ?

<5,6,3,4,(6,3,4)*>

X: (5,<3,5>) <5,6,3,5>

<5,6,3,4,6,3,5> †

<5,6,3,4,6,(3,4,6)*,3,5> †

† infeasible

Page 116: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying du-paths

du-pair path(s) du-path?

X: (5,7) <5,6,7> † yes

<5,6,3,4,6,7> yes

<5,6,3,4,6,(3,4,6)*,7> no

X: (5,<3,4>) <5,6,3,4> yes

<5,6,3,4,(6,3,4)*>

X: (5,<3,5>) <5,6,3,5>

<5,6,3,4,6,3,5> †

<5,6,3,4,6,(3,4,6)*,3,5> †

† infeasible

Page 117: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying du-paths

du-pair path(s) du-path?

X: (5,7) <5,6,7> † yes

<5,6,3,4,6,7> yes

<5,6,3,4,6,(3,4,6)*,7> no

X: (5,<3,4>) <5,6,3,4> yes

<5,6,3,4,(6,3,4)*> ?

X: (5,<3,5>) <5,6,3,5>

<5,6,3,4,6,3,5> †

<5,6,3,4,6,(3,4,6)*,3,5> †

† infeasible

Page 118: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying du-paths

du-pair path(s) du-path?

X: (5,7) <5,6,7> † yes

<5,6,3,4,6,7> yes

<5,6,3,4,6,(3,4,6)*,7> no

X: (5,<3,4>) <5,6,3,4> yes

<5,6,3,4,(6,3,4)*> no

X: (5,<3,5>) <5,6,3,5>

<5,6,3,4,6,3,5> †

<5,6,3,4,6,(3,4,6)*,3,5> †

† infeasible

Page 119: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying du-paths

du-pair path(s) du-path?

X: (5,7) <5,6,7> † yes

<5,6,3,4,6,7> yes

<5,6,3,4,6,(3,4,6)*,7> no

X: (5,<3,4>) <5,6,3,4> yes

<5,6,3,4,(6,3,4)*> no

X: (5,<3,5>) <5,6,3,5> ?

<5,6,3,4,6,3,5> †

<5,6,3,4,6,(3,4,6)*,3,5> †

† infeasible

Page 120: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying du-paths

du-pair path(s) du-path?

X: (5,7) <5,6,7> † yes

<5,6,3,4,6,7> yes

<5,6,3,4,6,(3,4,6)*,7> no

X: (5,<3,4>) <5,6,3,4> yes

<5,6,3,4,(6,3,4)*> no

X: (5,<3,5>) <5,6,3,5> yes

<5,6,3,4,6,3,5> †

<5,6,3,4,6,(3,4,6)*,3,5> †

† infeasible

Page 121: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying du-paths

du-pair path(s) du-path?

X: (5,7) <5,6,7> † yes

<5,6,3,4,6,7> yes

<5,6,3,4,6,(3,4,6)*,7> no

X: (5,<3,4>) <5,6,3,4> yes

<5,6,3,4,(6,3,4)*> no

X: (5,<3,5>) <5,6,3,5> yes

<5,6,3,4,6,3,5> † ?

<5,6,3,4,6,(3,4,6)*,3,5> †

† infeasible

Page 122: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying du-paths

du-pair path(s) du-path?

X: (5,7) <5,6,7> † yes

<5,6,3,4,6,7> yes

<5,6,3,4,6,(3,4,6)*,7> no

X: (5,<3,4>) <5,6,3,4> yes

<5,6,3,4,(6,3,4)*> no

X: (5,<3,5>) <5,6,3,5> yes

<5,6,3,4,6,3,5> † no

<5,6,3,4,6,(3,4,6)*,3,5> †

† infeasible

Page 123: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying du-paths

du-pair path(s) du-path?

X: (5,7) <5,6,7> † yes

<5,6,3,4,6,7> yes

<5,6,3,4,6,(3,4,6)*,7> no

X: (5,<3,4>) <5,6,3,4> yes

<5,6,3,4,(6,3,4)*> no

X: (5,<3,5>) <5,6,3,5> yes

<5,6,3,4,6,3,5> † no

<5,6,3,4,6,(3,4,6)*,3,5> † ?

† infeasible

Page 124: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Identifying du-paths

du-pair path(s) du-path?

X: (5,7) <5,6,7> † yes

<5,6,3,4,6,7> yes

<5,6,3,4,6,(3,4,6)*,7> no

X: (5,<3,4>) <5,6,3,4> yes

<5,6,3,4,(6,3,4)*> no

X: (5,<3,5>) <5,6,3,5> yes

<5,6,3,4,6,3,5> † no

<5,6,3,4,6,(3,4,6)*,3,5> † no

† infeasible

Page 125: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Another Dataflow Test Coverage

Criterion

• All-DU-Paths: for every program variable v, every du-path from every definition of v to every c-use and every p-use of v must be covered.

Page 126: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Exercise

• Identify all c-uses and p-uses for variable Y in Example 2.

• For each c-use or p-use, identify (using the “ * ” notation) all def-clear paths.

• Identify whether or not each def-clear path is feasible, and whether or not it is a du-path.

Page 127: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Exercise

• Identify all c-uses and p-uses for variable Y in Example 2.

• For each c-use or p-use, identify (using the “ * ” notation) all def-clear paths.

• Identify whether or not each def-clear path is feasible, and whether or not it is a du-path.

Page 128: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Exercise

• Identify all c-uses and p-uses for variable Y in Example 2.

• For each c-use or p-use, identify (using the “ * ” notation) all def-clear paths.

• Identify whether or not each def-clear path is feasible, and whether or not it is a du-path.

Page 129: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

Summary of White-Box Coverage

RelationshipsPath

All du-paths

All-Uses

All-Defs

Compound Condition

Branch / Condition Basis Paths Loop

Condition

Statement

Branch

*

- nominal cases*

Page 130: White-Box Testing Techniques IIWhite-Box Testing Topics •Logic coverage (lecture I) •Dataflow coverage (lecture II) •Path conditions and symbolic execution (lecture III) •Other

White-Box Testing Techniques II

Prepared by

Stephen M. Thebaut, Ph.D.

University of Florida

Software Testing and Verification

Lecture 8